Code review comments: HTML and inline css styles are not escaped #2851
Description
Inline styles
A user can create comments that contain HTML elements and inline css styles:
<script>
A comment can include a <script> tag. However, initial tests show that the script will not run:
Expected behavior:
- Should only standard markdown be supported for code review comments?
- Should a user be allowed to create HTML elements and use inline styles?